This critical Red Hat kernel-rt update addresses multiple vulnerabilities, including a critical (CVSS 9.1) flaw in netfilter's nf_conntrack_h323 module (CVE-2026-23455) allowing denial of service via zero-length packet handling, and a high-severity (CVSS 7.8) use-after-free in the CAN raw protocol (CVE-2026-31532). Affected Linux kernel versions include 4.1 through 6.6.136, 6.7 through 6.12.82, and specific 6.18 and 6.19 ranges, with fixes provided in versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1 respectively. A system reboot is required after applying the update.
Red Hat Product Errata RHSA-2026:41236 - Security Advisory Issued: 2026-07-17 Updated: 2026-07-17 RHSA-2026:41236 - Security Advisory Overview Updated Packages Synopsis Critical: kernel-rt security, bug fix, and enhancement update Type/Severity Security Advisory: Critical Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243) kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455) kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532) kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607) kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685) kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037) kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110) kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163) kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190) kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158) kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198) kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125) kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243) kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090) kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852) kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181) Bug Fix(es) and Enhancement(s): RHEL-124698 missed the last line of the backport (JIRA:RHEL-168608) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Affected Products Red Hat Enterprise Linux for Real Time for x86_64 - Extended Life Cycle Support 7 x86_64 Fixes BZ - 2448594 - CVE-2026-23243 kernel: Linux kernel: Denial of service and memory corruption in RDMA umad BZ - 2454810 - CVE-2026-23455 kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() BZ - 2461107 - CVE-2026-31532 kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() BZ - 2461521 - CVE-2026-31607 kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() BZ - 2461759 - CVE-2026-31685 kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets BZ - 2464351 - CVE-2026-43037 kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() BZ - 2467014 - CVE-2026-43110 kernel: wifi: brcmfmac: validate bsscfg indices in IF events BZ - 2467059 - CVE-2026-43163 kernel: md/bitmap: fix GPF in write_page caused by resize race BZ - 2467064 - CVE-2026-43190 kernel: netfilter: xt_tcpmss: check remaining length before reading optlen BZ - 2467210 - CVE-2026-43158 kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks BZ - 2467228 - CVE-2026-43198 kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() BZ - 2467234 - CVE-2026-43125 kernel: dlm: validate length in dlm_search_rsb_tree BZ - 2481486 - CVE-2026-46243 kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions BZ - 2481980 - CVE-2026-46090 kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop BZ - 2482166 - CVE-2026-45852 kernel: RDMA/rxe: Fix double free in rxe_srq_from_init BZ - 2482532 - CVE-2026-46181 kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() CVEs CVE-2026-23243 CVE-2026-23455 CVE-2026-31532 CVE-2026-31607 CVE-2026-31685 CVE-2026-43037 CVE-2026-43110 CVE-2026-43125 CVE-2026-43158 CVE-2026-43163 CVE-2026-43190 CVE-2026-43198 CVE-2026-45852 CVE-2026-46090 CVE-2026-46181 CVE-2026-46243 References https://access.redhat.com/security/updates/classification/#critical Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for Real Time for x86_64 - Extended Life Cycle Support 7 SRPM kernel-rt-3.10.0-1160.155.1.rt56.1307.el7.src.rpm SHA-256: ef6e7c280e10e6883c5d99f2002300fff0991a134d577af030399eb7542ab073 x86_64 kernel-rt-3.10.0-1160.155.1.rt56.1307.el7.x86_64.rpm SHA-256: 3d7a7f33b5a99f8484062567b13a9f42af94ebefd4b9304f1d557d925ae04cee kernel-rt-debug-3.10.0-1160.155.1.rt56.1307.el7.x86_64.rpm SHA-256: 8d65f0a33223ac3bca3541941b254596d9974340e5193af3c64e3c37323b6a81 kernel-rt-debug-debuginfo-3.10.0-1160.155.1.rt56.1307.el7.x86_64.rpm SHA-256: a8583a8b2e30b82489da33915867b8763294ff16d34812bd0b2d103d8b7ceb28 kernel-rt-debug-devel-3.10.0-1160.155.1.rt56.1307.el7.x86_64.rpm SHA-256: 478d70f6b67fbecc9e7c4815e7ca4706473675e5df778c410d3fa6a5cfb9233a kernel-rt-debuginfo-3.10.0-1160.155.1.rt56.1307.el7.x86_64.rpm SHA-256: 8db414db2e3d6f7c7ef54b897c51f38e838f3d5fa591f2e5f6e5328dc8908bd3 kernel-rt-debuginfo-common-x86_64-3.10.0-1160.155.1.rt56.1307.el7.x86_64.rpm SHA-256: bcbd91129610600f99ab35437d6ce305911a2ad4acbd3f1f4efa0d3cb9daa62d kernel-rt-devel-3.10.0-1160.155.1.rt56.1307.el7.x86_64.rpm SHA-256: 8a4cc3e5e872524950cbcbc12900b8522c1417cd79f38efead9df9980800ac3a kernel-rt-doc-3.10.0-1160.155.1.rt56.1307.el7.noarch.rpm SHA-256: 66ba553fb305041b4b9a7308b06fad38b726d711f8c69a5afec2aa370672118b kernel-rt-trace-3.10.0-1160.155.1.rt56.1307.el7.x86_64.rpm SHA-256: a2b1faca44b7ff8c10a2b6a0dc979fe189378037c71257ebe6dbe4d00741305d kernel-rt-trace-debuginfo-3.10.0-1160.155.1.rt56.1307.el7.x86_64.rpm SHA-256: 64702db23a5311df826848e7be0c4e4cdc9d7e3dba852b8e75263146ffffcf96 kernel-rt-trace-devel-3.10.0-1160.155.1.rt56.1307.el7.x86_64.rpm SHA-256: a80b816872d20a68c90fe053f6d198aa251551041eb286d50035fcee6e1ca725 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .